A Simple Power Analysis Attack on the Twofish Key Schedule Jose Javier Gonzalez Ortiz∗ Kevin J. Compton† University of Michigan University of Michigan November 23, 2016 Abstract This paper introduces an SPA power attack on the 8-bit implementation of the Twofish block cipher. The attack is able to unequivocally recover the secret key even under substantial amounts of error. An initial algorithm is described using exhaustive search on error free data. An error resistant algorithm is later described. It employs several threshold preprocessing stages followed by a combined approach of least mean squares and an optimized Hamming mask search. Further analysis of 32 and 64-bit Twofish implementations reveals that they are similarly vulnerable to the described SPA attack. Keywords: Twofish, SPA, Power Attack, Block Cipher, Error Tolerance 1 Introduction In 1997, the National Institute of Standards and Technology (NIST) started the Advanced Encryption Standard process in order to designate a successor of the aged Digital Encryption Standard (DES). Among the five finalists is the Twofish block cipher, and although in the end Rijndael was designated as the winner of the AES contest, Twofish was one of the strongest contenders, excelling in categories such as general security, hardware performance and design features. After the introduction of linear and differential attacks they became a concern in the design of new ciphers. Thus, the encryption and key schedule algorithms of the submissions were designed to prevent these types of attacks. Nevertheless, arXiv:1611.07109v1 [cs.CR] 22 Nov 2016 among the finalists both AES and Serpent have been found to be susceptible to side-channel attacks. These attacks focus on the information that can be gained from the physical implementation of cryptosystems in especially accessible systems such as smart cards. In 1999 Biham and Shamir [BS99] carried out a preliminary analysis of power attack susceptibility of various AES candidates. They assessed that Twofish Key Schedule had a complex structure and seemed not to reveal direct information on the key bits from Hamming measurements. The results presented in this work refute this assertion since an efficient and robust SPA attack that retrieves the secret key was found. ∗[email protected] †[email protected] 1 1.1 Previous Work 1 INTRODUCTION We present a side channel attack on the Twofish key schedule which finds the secret key in just one execution of the algorithm. Further analysis of the algorithm and the different existing implementations render all of them vulnerable to this attack, posing a concern for the way 8-bit manipulations are described and performed in the Twofish Key Schedule. We will start by providing a background in the Twofish Block Cipher operation and the formulation of its associated Key Schedule in Section 2. Section 3 describes an attack provided error free data by employing a reduced exhaustive search for each byte of the key. The attack is then incrementally improved in Section 4 to cope with a more than significant amount of measurement error. Section 5 displays the accuracies achieved under varying degrees of error and key size as well as the elapsed times. These results are later analyzed on Section 6 and further work is outlined in Section 7. 1.1 Previous Work Side Channel Attacks were first described in 1996 by Kocher [Koc96] with the introduction of timing attacks, which had the ability of compromising a cryptosystem by analyzing the time taken to execute specific parts of cryptographic algorithms. However, these attacks can be easily overcome by employing simple software countermeasures. Since access to the hardware was one of the assumptions, attacks that used the power consumption of the cryptosystem started developing. The first research power attack is credited to Kocher et al [KJJ99], in which they were able to obtain information of the data manipulated by the processor by carefully measuring the power consumption of a CMOS chip. In his work, two different types of power attacks are described: • Differential Power Attacks (DPA) – In an analogous fashion to classical differential cryptanalysis, DPAs try to find patterns and relationships between plaintexts and their associated power traces. Similarly, a large amount of samples are required for the results to convey statistical significance. • Simple Power Attacks (SPA) – An SPA focuses in particular vulnerabilities of the algorithm design. These vulnerabilities could leak enough sensitive information to compromise the confidentiality of the encryption or even the secret key itself. Since microprocessors perform discrete operations on blocks of data in a sequential fashion, physical imperfections of the system make possible to correlate the Hamming weights of the manipulated values and the power utilization. Research has proved that this correlation is significant enough to find Hamming weights of numerous intermediate variables from the power utilization, as shown in the works of [MDS02] and [MS00]. The concern of these types of attacks has lead to a number of research efforts [Mes01], [MOP07] to thwart them by masquerading the power consumption values in order to break the correlation that Power Attack use as a basis to acquire information. Nevertheless, they are still far from being industry standards and most modern smartcards and ASICs do not yet include mechanisms like those ones by default. Thus, for the purpose of this paper said techniques have not been considered. Recent research efforts have shown that both Rijndael [VBC05] and Serpent [CTV09] key schedules are susceptible to Simple Power Attacks. Both attacks used a power trace of the algorithm to unequivocally 2 2 TWOFISH BLOCK CIPHER recover the secret key used in the encryption. In both cases the weakness arose from the key schedule computation; patterns in the hamming weights of the key schedule algorithm revealed enough informa- tion to compromise the secret key. Twofish’s key schedule follows different principles and constructions to generate the necessary subkeys but it is nonetheless susceptible to this type of attack as this paper demonstrates. Even though Twofish smart-card implementation performance and versatility have been thoroughly analyzed [Kea99], [RHW11], no power attacks have been found for the encryption algorithm or the key schedule. Nevertheless, analysis on the key schedule such as [MM99] have outlined some deficiencies and weaknesses in the cipher. 2 Twofish Block Cipher Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It was one of the five finalists of the Advanced Encryption Standard contest. It was submitted by Schneier et al. [SKW+98]. Twofish features pre-computed key-dependent S-boxes, and a relatively complex key schedule. One half of an n-bit key is used as the actual encryption key and the other half of the n-bit key is used to modify the encryption algorithm. Twofish borrows some elements from other designs such as a Feistel structure from DES or the pseudo-Hadamard transform [STM10] from the SAFER family of ciphers [Mas94]. This section will briefly introduce the encryption scheme and key schedule in the Twofish block cipher following the notation and terminology from [SKW+98]. 2.1 The Twofish Encryption Algorithm The Twofish encryption is a 16 round Feistel Network with both input and output whitening. Each round operates only in the higher 64 bits of the block and swaps both halves. A total of 40 subkeys are generated from the secret key, with each key being 32 bits. Keys K0 ... K3 are used for the input whitening, K4 ... K7 are used for the output whitening and K8 ... K39 are used as the round subkeys. Each round employs a function F which is a key-dependent permutation on 64-bit values. The function F splits the 64-bit string into two 32-bit substrings and applies the g function to each half. The function g applies a fixed number of S-box substitutions and XORs with parts of the secret key (the number of steps this is performed depends on the size of the key). This is followed by a MDS (Maximum Distance Separable) Matrix transform, a Pseudo-Hadamard Transform and round key XOR with the two subkeys associated for that said round. Therefore each round r uses two subkeys as round key, namely K2r+8 and K2r+9. Finally, the output is XORed with one half of the block following the Feistel Network scheme. Bit wise rotations and shifts are performed at strategic points in the encryption to maximize diffusion. They have been omitted to simplify the explanation. The algorithm can be visualized in Figure 2.1 3 2.1 The Twofish Encryption Algorithm 2 TWOFISH BLOCK CIPHER Plaintext (128 bit) K0 K1 K2 K3 Input whitening g <<<1 S-box 0 MDS PHT K2r+8 S-box 1 S-box 2 S-box 3 g One round S-box 0 MDS S-box 1 <<<8 S-box 2 K S-box 3 2r+9 >>>1 ... 15 more rounds Undo last swap K K 4 5 K6 K7 Output whitening Ciphertext (128 bits) Legend Exclusive-or Addition modulo 2 32 <<< Rotation Figure 2.1: Twofish algorithm 4 2 TWOFISH BLOCK CIPHER 2.2 The Twofish Key Schedule 2.2 The Twofish Key Schedule The key schedule has to provide 40 32-bit words of expanded key K0, ... , K39. Twofish is defined for sizes N = f128, 192, 256g. Keys shorter can be padded with zeros to the next larger key length. The key is split into 2R 32-bit words K = (M0, M1,... M2R−1) where R = N/64. To generate each sub-key all the bits in the secret key are employed. The secret key is also employed to derive the vector S = (SR−1, SR−2, ... , S0) which is obtained by applying a Reed Solomon Transformation to the key.